Lucene search

Gentoo FoundationGLSA-200311-07

HistoryNov 22, 2003 - 12:00 a.m.

phpSysInfo: arbitrary code execution and directory traversal

2003-11-2200:00:00

Gentoo Foundation

security.gentoo.org

3.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

0.001 Low

EPSS

Percentile

22.6%

JSON

Background

phpSysInfo is a PHP system information tool.

Description

phpSysInfo contains two vulnerabilities which could allow local files to be read or arbitrary PHP code to be executed, under the privileges of the web server process.

Impact

An attacker could read local files or execute arbitrary code with the permissions of the user running the host web server.

Workaround

There is no known workaround at this time.

Resolution

It is recommended that all Gentoo Linux users who are running www-apps/phpsysinfo upgrade to the fixed version:

 # emerge sync
 # emerge -pv '&gt;=www-apps/phpsysinfo-2.1-r1'
 # emerge '&gt;=www-apps/phpsysinfo-2.1-r1'
 # emerge clean

OSVersionArchitecturePackageVersionFilename
Gentooanyallwww-apps/phpsysinfo<= 2.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Gentoo	any	all	www-apps/phpsysinfo	<= 2.1	UNKNOWN

3.6 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:N/A:P

0.001 Low

EPSS

Percentile

22.6%

JSON

Related for GLSA-200311-07